Security & Auditing Skills

Enforces dependency health rules (DEP-1 through DEP-5). Loaded by the conductor for dependency update operations and CI full-check runs. Detects known vulnerabilities, version lag, unused dependencies, misclassified dev/prod dependencies, and unpinned production versions. Invokes scripts/depaudit.sh for automated vulnerability scanning. Activated by: "check dependencies", "update deps", "CVE", "vulnerability scan", "npm audit".

Enforces IaC security rules (IAC-1 through IAC-5). Loaded by the conductor for security audits and review operations on infrastructure-as-code files. Detects public storage buckets, containers running as root, missing encryption-at-rest, wildcard IAM policies, and exposed ports in security groups. Supports Terraform HCL, CloudFormation YAML/JSON, and Kubernetes manifests; other dialects are skipped gracefully.

Enforces naming convention rules (NAME-1 through NAME-7, plus NAME-UL). Loaded by the conductor for write and review operations. Detects meaningless names, incorrect boolean prefixes, misleading names, abbreviations, naming inconsistencies, and (for files in core/) generic technical suffixes that drift away from ubiquitous language. Loads references/{language}.md for language-specific casing conventions before checking.

Enforces observability rules (OBS-1 through OBS-5). Loaded by the conductor for review, incident response, and new service scaffolding. Detects empty catch blocks, unstructured logging, missing endpoint tracing, absent health checks, and vague error messages. Activated by: "incident", "on call", "debugging production", "empty catch", "logging", "observability", "health check".

Bridge ready-to-merge work into commit, push, and PR publication, deflecting versioning and release concerns to release.

Enforces functional-core purity rules: PURE-1 (no side effects in core/ modules — no I/O, no clock, no RNG, no logging), PURE-2 (no ambient/global state reads in core), PURE-3 (mock-required-to-test signal — if a function needs a mock to test, it isn't pure and belongs in shell). Loaded by the conductor for write and review operations when core-layer code is in scope. Layer detection follows the conductor's Section 14.

Static resilience-pattern analysis. Detects missing retry/backoff, absent circuit breakers, unbounded timeouts, and missing deadline propagation in TypeScript, JavaScript, Python, Go, and Rust. Wired into the conductor's review and write operations.

Enforces security rules (SEC-1 through SEC-7). Loaded by the conductor for security audits, PR/code reviews, incident response, and new service scaffolding. Detects hardcoded secrets, insecure credential handling, XSS vectors, SQL injection, gitignore gaps, stale credentials, and CORS misconfigurations. Invokes scripts/scansecrets.sh for automated scanning. Activated by: "security audit", "check for secrets", "vulnerabilities", "hardcoded key", "SQL injection", "review".